$words[rand()]

Programming, politics, and pissed off rants…

TSA Security Fail

Everybody’s friends over at the TSA had a nice fail at some point when they posted a redacted ver­sion of their “Avi­a­tion Secu­rity Screen­ing Man­age­ment Stan­dard Oper­at­ing Pro­ce­dures” on their web site. Unfor­tu­nately for them, redact­ing by draw­ing boxes over the text and images in Acro­bat doesn’t really do any­thing use­ful, the con­tent is still there. It took a few months before some­one noticed, but once that hap­pened the Inter­net took hold and the great guys over at Cryp­tome stripped all the cen­sor­ing, replac­ing it with red boxes to clearly mark what the TSA con­sid­ers “sen­si­tive” and posted the result on their web site. I’m also mir­ror­ing the same here. I’ve skimmed the whole man­ual and read the cen­sored parts in their entirety, I hon­estly can’t fig­ure out why they even felt the need to cen­sor. Gov­ern­ments should be open unless they can pro­vide good rea­son not to be, not closed by default.

TSA Screen­ing Pro­ce­dures (41)

Move complete!

If you are see­ing this post, your DNS servers have updated and noticed that my old VPS on JaguarPC is no longer where they should look. My blog and other ran­dom shit has now been moved over to Lin­ode, where they don’t block IRC and other things I run on my box.

Steam claiming it is being run in compatibility mode on Vista and Windows 7

Today I had Steam start throw­ing an error that it is being run in com­pat­i­bil­ity mode when I had never set such a thing, nor were either the short­cut or EXE itself flagged for com­pat­i­bil­ity mode. Thanks to a lit­tle googling, I found this thread on the Steam forums which finally had a solution.

Open the reg­istry edi­tor (if you don’t know how to do this, you should not be mess­ing around in the reg­istry) and browse to HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers and HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers. Look for entries in those keys men­tion­ing steam.exe and delete them. Restart Steam and you’re set!

Quick Post-Dayton Update

Got back home from the Day­ton Hamven­tion around 8 PM last night. I went there plan­ning on buy­ing an entry-level HT, but I ended up get­ting attracted to shiny things and bought a Yaesu VX-7R rather than my intended tar­get of some­thing in the FT-60R range. Made a few con­tacts on the trip back, unfor­tu­nately I don’t remem­ber many calls or names, the only ones I can recall are Ron (W8RON) and I think another guy both Ron and I talked with was named Kyle, I can’t remem­ber his call.

So I’m finally on the air the “proper” way rather than just being tied to Echolink. Woo!

–KD8JQS

Evolution

Evo­lu­tion

A quick primer to send to any cre­ation­ists you may know.

Edit: Appar­ently the Youtube Word­press auto-post thing neglects to set the title.

Could Pat Robertson get any more out of touch with reality?

Yes­ter­day Pat Robert­son made another one of his trade­mark idi­otic state­ments. In response to Maine pro­vid­ing homo­sex­ual cou­ples the right to marry, Mr. Robert­son went on CBN and opened his mouth to let this shit drib­ble out:

Here is a tran­script, snagged from Think Progress:

HOST: Mean­while, the New Hamp­shire leg­is­la­ture has also voted in favor of gay mar­riage, but Pat, the gov­er­nor there still isn’t sure if he will approve that bill.

ROBERTSON: Lee, we haven’t taken this to its ulti­mate con­clu­sion. You got polygamy out there. How can we rule that polygamy is ille­gal when you say that homo­sex­ual mar­riage is legal. What is it about polygamy that’s dif­fer­ent? Well, polygamy was out­lawed because it was con­sid­ered immoral accord­ing to bib­li­cal stan­dards. But if we take bib­li­cal stan­dards away in homo­sex­u­al­ity, what about the other? And what about bes­tial­ity and ulti­mately what about child molesta­tion and pedophilia? How can we crim­i­nal­ize these things and at the same time have con­sti­tu­tional amend­ments allow­ing same-sex mar­riage among homo­sex­u­als. You mark my words, this is just the begin­ning in a long down­ward slide in rela­tion to all the things that we con­sider to be abhorrent.

He starts off with what is actu­ally a very good point. If polygamy was made ille­gal for reli­gious rea­sons, then it most cer­tainly should not be ille­gal. Of course my posi­tion is the reverse of his, so I see it as “so why is polygamy still ille­gal?” He then steps off the logic bus and boards the crazy train by claim­ing the next steps would then be bes­tial­ity and pedophilia. There’s this lit­tle detail he’s ignor­ing of course, and that is informed adult con­sent. Homo­sex­ual mar­riages are between two con­sent­ing adults. Polygamy would also be a num­ber of mar­riages between con­sent­ing adults. Bes­tial­ity, pedophilia, and all the other things the Chris­t­ian cra­zies claim nec­es­sar­ily fol­low gay mar­riage clearly don’t.

Can some­one please tell me why peo­ple keep lis­ten­ing to this igno­rant idiot?

Video cour­tesy Media Mat­ters.
Tran­script and inspi­ra­tion to write cour­tesy Think Progress.

VMware ESXi 3.5u4, Intel SATA, and local datastores

This morn­ing I rebooted my test box run­ning VMware ESXi 3.5 to com­plete the upgrade from Update 3 to Update 4. The hyper­vi­sor came back up, but no guests were run­ning and when I popped open the VI Client it indi­cated that there were no data­s­tores con­fig­ured and it could not find any of the vir­tual machines I had in inven­tory. It saw the inter­nal disks and that they were for­mat­ted VMFS, but would not allow me to do any­thing other than for­mat them over again.

Nor­mally this would have sim­ply annoyed me since I would have lost my test VMs, but they don’t take long to build so I’d have just for­mat­ted them and gone on with my day. Unfor­tu­nately within the last week we had tem­porar­ily moved a crit­i­cal application’s VM to this box and we had not prop­erly recon­fig­ured backup. I could restore from the week old backup, but there would be hell to pay.

Since the VMFS par­ti­tions were clearly vis­i­ble I felt I had a chance, but I’m still new to ESX/ESXi so my first step was to flip over to my always run­ning irssi ses­sion (if you use IRC and do not use screened irssi, go Google it now and enjoy) and ask for help in #shsc and #vmware. #shsc always has a few guys who work on large VMware installs idling, and of course #vmware is obvi­ous. While wait­ing for any input from IRC, I went to Google for my next step. I knew ESXi has the capa­bil­ity to be accessed via SSH, but it’s dis­abled by default, so I looked up how to turn it on. A few min­utes later after bring­ing a mon­i­tor over to the machine and reboot­ing it I had SSH access and could go through sys­tem logs from the com­fort of my laptop.

In /var/log/messages I found two entries ref­er­enc­ing my SATA con­troller which looked inter­est­ing:
May 5 14:34:35 vmkernel: 0:00:06:39.406 cpu0:3616)ALERT: LVM: 4482: vmhba000:0:0:3 may be snapshot: disabling access. See resignaturing section in SAN config guide.
May 5 14:34:35 vmkernel: 0:00:06:39.408 cpu0:3616)ALERT: LVM: 4482: vmhba0:0:0:1 may be snapshot: disabling access. See resignaturing section in SAN config guide.

This infor­ma­tion, after a quick trip to Google, led to VMware’s SAN con­fig­u­ra­tion guide which ref­er­ences sim­i­lar issues occur­ring on SANs, so I tried enabling the res­ig­na­tur­ing option and mag­i­cally my data­s­tores reap­peared. After renam­ing them back to their orig­i­nal names and turn­ing the res­ig­na­tur­ing option back off I had all my data and was able to down­load the disk images and VMX files so I was safe in the event of a major problem.

At this point, I could see my VMs but the VI inven­tory was still con­vinced that they were on the “old dri­ves”, so after a bit more time on Google I dis­cov­ered the Import fea­ture within the data­s­tore browser and I was able to bring the VMs back in and get them boot­ing up.

After con­firm­ing that the VMs I really needed were boot­ing and oper­a­tional, I shut every­thing down to move the server back to its spot in my rack. For­tu­nately every­thing came right back up so the pres­sure was now off.

Now my con­cerns shifted. If this hap­pened once, what’s to stop it from hap­pen­ing again? I needed to fig­ure out why it hap­pened. For­tu­nately at nearly the exact moment I started think­ing about this IRC came through for me. “jidar” in #shsc linked to this thread on VMware’s forum with lit­er­ally the exact same symp­toms. A few posts down was a link to this page which again matched my expe­ri­ence exactly and says that U4 updated a num­ber of SATA dri­vers includ­ing the one for the ICH9 con­troller in my Pow­erEdge and changed the way they appear to the hyper­vi­sor, which led to it not rec­og­niz­ing the dri­ves for what they are.

Right now I’m mod­er­ately annoyed at an update that’s not even enough to earn it a minor ver­sion num­ber bump on a piece of soft­ware intended for enter­prise use hav­ing a change with the poten­tial to cause this, but on the other hand I don’t expect any­one who really cares about reli­a­bil­ity to be using SATA local stor­age. Ah well, I learned a bit about nav­i­gat­ing around ESXi’s internals.

Coming Soon: Comparison of PC-based router/firewall platforms

Over the com­ing weeks I will be spend­ing one week each with a num­ber of PC-based router/firewall prod­ucts installed as the pri­mary NAT gate­way at my apart­ment. I will be review­ing them based on over­all per­for­mance, inter­op­er­abil­ity with my SIP-based VoIP ser­vice, QoS capa­bil­i­ties, VPN capa­bil­i­ties, and any extra fea­tures that make them stand out from the crowd.

The test plat­form will be a Dell Pow­erEdge SC430 with a 1.6 GHz Intel Xeon dual core proces­sor and 4GB of RAM. The cur­rent list of soft­ware to test is as follows:

• pfSense 1.2 (Stable)
• pfSense 2.0 (Alpha)
• Untan­gle Open Source 6.1
• Vyatta Com­mu­nity 5

I will also be test­ing “appli­ance” type routers based on what is avail­able to me, which cur­rently is as follows:

• Linksys WRT54GL (Linksys firmware 4.30.12)
• Linksys WRT54GL (Tomato 1.23)
• Linksys WRT54GL (DD-WRT v24 SP1 Mega)
• Linksys WRT54GL (Open­WRT Kamikaze 8.09)
• Cisco 1841 (IOS 12.4(23))
• Watch­guard Fire­box X Edge
• Edge­wa­ter Edge­marc 4500 (VOS 9.1.2)

The Watch­guard is cur­rently unknown due to not hav­ing the pass­word for it and I may cut down the list of Linksys firmwares, but all of the rest will be tested.

Hard­ware or soft­ware sug­ges­tions for fur­ther test­ing are appreciated.

On “religious freedom” in the workplace…

With the Obama admin­is­tra­tion look­ing like they will be rolling back Bush era poli­cies allow­ing doc­tors to refuse to per­form cer­tain pro­ce­dures and/or refuse to pre­scribe or sell cer­tain med­ica­tions (let’s say RU-486 for exam­ple) the Internet’s polit­i­cal debate hotspots have erupted as expected. Over at the Some­thing Awful forums I saw a great post that com­pletely explains my posi­tion on this issue:

It’s a sad reflec­tion on the influ­ence of the reli­gious right that this is even a note­wor­thy issue. If you work at Burger King, and one day you decide that you don’t like the Dou­ble Whop­per and won’t serve it to peo­ple any­more (say, for rea­sons of their health), you get fired. If you’re an net­work admin­is­tra­tor and one day decide that TCP/IP is the devil’s pro­to­col and you won’t use it, you get fired. The list goes on. Giv­ing peo­ple the legal med­ica­tion they need is the job of the phar­ma­cist and doc­tor. Their job is not “Make value judg­ments about my patients and then pre­scribe what med­ica­tions I per­son­ally believe are good”. We have a cen­tral reg­u­la­tory body that deter­mines what med­i­cines and pro­ce­dures are legal to give out and per­form. Doc­tors and phar­ma­cists are expected to adhere to these. A phar­ma­cist who decided that he would no longer give can­cer patients their drugs or a doc­tor who decided he will sub­sti­tute phrenol­ogy for a gen­eral exam would find them­selves out of jobs in short order. The only rea­son this is an issue is because for some rea­son “It’s my reli­gion!” is taken as a valid excuse for not doing your job.

If you are a phar­ma­cist, it is your job to dis­pense med­ica­tions as pre­scribed. Your per­sonal morals have absolutely no legit­i­mate influ­ence on this. If you do not like this fact, find another job. What the right wing wants here would be equiv­a­lent to a paci­fist join­ing the Marines and then com­plain­ing that they were being sent to war.

If you’re still con­vinced that this “reli­gious free­dom” is the right option, pre­tend you live in a small town with one local doc­tor. Now pre­tend that doc­tor is a Jehova’s Wit­ness. Now think about what hap­pens if you or a loved one needs a trans­fu­sion. Your local doc­tor would then be fully able to refuse to give you/your loved one a trans­fu­sion because it goes against their religion.

If you don’t like the job require­ments, find another job. Don’t whine that you chose a job that con­flicts with your beliefs. Put up or shut up, either way your morals don’t have any effect on me.

Potentially serious vulnerability in a number of SIP endpoints

Sjur Usken and San­dro Gauci have dis­cov­ered a major flaw in the SIP imple­men­ta­tions on a wide range of IP phones. The short expla­na­tion is that the phones do not ver­ify where a proxy authen­ti­ca­tion request is com­ing from and hap­pily return the SIP authen­ti­ca­tion infor­ma­tion. It is hashed and salted, but the salt is cho­sen by the attacker, so a set of rain­bow tables would make crack­ing it triv­ial. For full details, check out Sjur’s blog post (which spread fairly rapidly around the VoIP world) and his lat­est post show­ing the trace as he attacked a Cisco 7940 I set up for this purpose.

Until the phone ven­dors release fixed firmware (if they do) the only way to defend your­self from this is to not have phones exposed on pub­lic IP addresses. If they have to be for some rea­son (we all know SIP and NAT really don’t get along, and proper SIP aware NAT devices cost a fair bit) set fire­wall rules that pre­vent the phones from speak­ing SIP to any IPs that aren’t part of your VoIP sys­tem. Alter­na­tively, in the event that every sin­gle phone on your sys­tem is sta­t­i­cally addressed, the reverse could be done at the reg­is­trar side. It wouldn’t stop the attack­ers from find­ing the pass­word, but it would pre­vent them from using it in any way.

The impli­ca­tions of an attacker gain­ing the SIP authen­ti­ca­tion infor­ma­tion are of course severe, once they have that they can imi­tate the attacked phone and make calls to any num­ber of regions poten­tially cost­ing thou­sands of dol­lars in the course of a sin­gle night.

Powered by Wordpress | WP Premium theme by WP Remix
Copyright 2007. $words[rand()]. All rights reserved

• Home
• About Me
• Disclaimer

$words[rand()] is using WP-Gravatar

SEO Powered by Platinum SEO from Techblissonline